The price, and what it buys.
The Sentinel Security Risk Analysis is a bounded engagement with a published price of $2,895. No membership is required, there is no recurring charge, and when the engagement ends there is no ongoing obligation on either side.
- A conducted analysis, not a generated document — where your electronic patient information actually lives, the threats and safeguards specific to your practice, and likelihood and impact rated with the reasoning recorded.
- A Remediation Register — every finding with an owner, a target date, and the evidence required to close it.
- Federal exclusion screening, performed twice — at the assessment and again at the six-month review. Texas practices are screened against the Texas HHSC list as well.
- A Six-Month Remediation Review and its written status report. Included in the one-time fee; there is no second invoice for it.
Finding the risk is the first half. The rule's next specification asks you to implement measures sufficient to reduce what you found, which is why every finding here lands somewhere it can be worked rather than somewhere it can be filed.
Yes — and the rule names no deadline.
45 C.F.R. § 164.308(a)(1)(ii)(A) lists risk analysis as a required implementation specification, and § 164.306(d)(2) says a covered entity must implement the specifications marked Required.
45 C.F.R. § 164.308(a)(1)(ii)(A)What the rule does not do is name a frequency. An annual review is a widely used operating standard — ours included — not a statutory deadline. The practical test is whether your analysis still describes the practice you are actually running.
Why we publish the price
Security Risk Analysis pricing is often quoted only after a sales conversation, because prices genuinely vary with practice size, location count, and whether remediation tracking is included at all or sold separately. None of that is wrong. But a practice manager comparing options deserves a number they can see before spending an hour on the phone.
Publishing the price is the same philosophy as the analysis itself: things you can verify beat things you are asked to believe.
What can change the number
Honestly, very little. Multi-location groups are scoped before we begin, so the number is known up front. And if the analysis finds little risk, the report says so — we do not manufacture findings to justify the fee, or to sell a membership afterwards.
If you are weighing this against the free HHS tool, we have written out the difference — including when the free tool is the right choice.
Common questions about the cost
For an independent practice, no — $2,895 is the published flat price for the standalone engagement. Multi-location groups are scoped before we begin, so you know the number before any work starts.
A conducted analysis rather than a questionnaire, ending in two artifacts you keep: a written, practice-specific analysis, and a Remediation Register that tracks every finding to closure with an owner and a date. You can read a complete sample before you decide anything.
Yes — it is included in the fully managed program. The $2,895 standalone engagement exists for practices that want the analysis without a membership, and if you later move to the managed program that fee is credited toward it.
No. There is no setup fee, no onboarding fee, and no second invoice when we return at six months. The return visit is part of the engagement, not an add-on.
A generally useful note for owners: professional compliance services are typically an ordinary business expense for the practice — your CPA can confirm how that applies to you.
The next step
Read the full description of the engagement, open a complete sample analysis and the six-month status report built from fictional practice data, or start with the free Readiness Proof Test. Practices anywhere in the U.S. can engage remotely — see how remote onboarding works.